diff --git a/backend/src/main/java/io/dataease/commons/utils/DeFileUtils.java b/backend/src/main/java/io/dataease/commons/utils/DeFileUtils.java index 6adc42e9be..2dcee5fa41 100644 --- a/backend/src/main/java/io/dataease/commons/utils/DeFileUtils.java +++ b/backend/src/main/java/io/dataease/commons/utils/DeFileUtils.java @@ -1,5 +1,7 @@ package io.dataease.commons.utils; +import io.dataease.commons.exception.DEException; +import org.apache.commons.lang3.StringUtils; import org.springframework.web.multipart.MultipartFile; import java.io.*; @@ -41,6 +43,17 @@ public class DeFileUtils { if (dir.exists()) return ; dir.mkdirs(); } + + public static void validateFile(MultipartFile file) { + String name = getFileNameNoEx(file.getOriginalFilename()); + if (StringUtils.contains(name, "./")) { + DEException.throwException("file path invalid"); + } + String suffix = getExtensionName(file.getOriginalFilename()); + if (!StringUtils.equalsIgnoreCase(suffix, "zip")) { + DEException.throwException("please upload valid zip file"); + } + } /** * 将文件名解析成文件的上传路径 */ diff --git a/backend/src/main/java/io/dataease/controller/sys/SysPluginController.java b/backend/src/main/java/io/dataease/controller/sys/SysPluginController.java index 7f3b3e669f..d8e32122c4 100644 --- a/backend/src/main/java/io/dataease/controller/sys/SysPluginController.java +++ b/backend/src/main/java/io/dataease/controller/sys/SysPluginController.java @@ -3,10 +3,11 @@ package io.dataease.controller.sys; import com.github.pagehelper.Page; import com.github.pagehelper.PageHelper; import io.dataease.auth.annotation.SqlInjectValidator; -import io.dataease.plugins.common.base.domain.MyPlugin; +import io.dataease.commons.utils.DeFileUtils; import io.dataease.commons.utils.PageUtils; import io.dataease.commons.utils.Pager; import io.dataease.controller.sys.base.BaseGridRequest; +import io.dataease.plugins.common.base.domain.MyPlugin; import io.dataease.service.sys.PluginService; import io.swagger.annotations.Api; import io.swagger.annotations.ApiOperation; @@ -41,6 +42,7 @@ public class SysPluginController { @PostMapping("upload") @RequiresPermissions("plugin:upload") public Map localUpload(@RequestParam("file") MultipartFile file) throws Exception { + DeFileUtils.validateFile(file); return pluginService.localInstall(file); } @@ -54,7 +56,8 @@ public class SysPluginController { @ApiOperation("更新插件") @PostMapping("/update/{pluginId}") @RequiresPermissions("plugin:upload") - public Map update(@PathVariable("pluginId") Long pluginId, @RequestParam("file") MultipartFile file) throws Exception{ + public Map update(@PathVariable("pluginId") Long pluginId, @RequestParam("file") MultipartFile file) throws Exception { + DeFileUtils.validateFile(file); if (pluginService.uninstall(pluginId)) { return pluginService.localInstall(file); } diff --git a/backend/src/main/java/io/dataease/ext/ExtPanelViewLinkageMapper.xml b/backend/src/main/java/io/dataease/ext/ExtPanelViewLinkageMapper.xml index 8fcc5c4476..88629926ca 100644 --- a/backend/src/main/java/io/dataease/ext/ExtPanelViewLinkageMapper.xml +++ b/backend/src/main/java/io/dataease/ext/ExtPanelViewLinkageMapper.xml @@ -61,7 +61,7 @@ dataset_table_field.origin_name, dataset_table_field.`name`, dataset_table_field.de_type - from dataset_table_field where table_id = #{table_id} + from dataset_table_field where dataset_table_field.group_type = 'd' and table_id = #{table_id}